Share via


Export search results in eDiscovery

After a search associated with a Discovery (preview) case is successfully run, you can export the search results. When you export search results, mailbox items are downloaded in PST files or as individual messages. When you export content from SharePoint and OneDrive sites, copies of native Office documents and other documents are exported. When you export items, the items are prepared for download depending on the export options that you define. You can monitor the export's progress and download the results from the Process manager page. Larger exports might take longer to complete.

Tip

Get started with Microsoft Security Copilot to explore new ways to work smarter and faster using the power of AI. Learn more about Microsoft Security Copilot in Microsoft Purview.

To learn more about new eDiscovery export enhancements and the retirement of the Microsoft Office 365 eDiscovery Export Tool, check out the following video:

Export search results

Tip

Do you prefer an interactive configuration guide experience? Check out the Export data guide.

To export search results, complete the following steps:

  1. Go to the Microsoft Purview portal and sign in using the credentials for a user account assigned eDiscovery permissions.

  2. Select the eDiscovery solution card and then select Cases.

  3. Select a case, then select the Searches tab. Select a search query to export.

  4. In the search query, select Export.

  5. On the Export flyout pane, configure export options.

  6. Enter a name for the export in Export name. This field is required.

  7. In Export description, enter an optional description for the export.

  8. In the Select items to include in your export, select one of the following options:

    • Indexed items that match your search query: This option exports only the indexed items that matched the query
    • Indexed items that match your search query and partially indexed items that might not match query: This option export only the indexed items that matched the query and the partially indexed or unindexed items that might not completely match the query
    • Partially indexed items that might not match query: This option exports only the partially indexed or unindexed items that might not completely match the query
  9. In the OneDrive and SharePoint items section, select from the following document options:

    • Select document versions Specify how many versions of SharePoint documents to export. Values are Latest version only, Recent 10 versions, Recent 100 versions, All versions.
    • Select folder items: Export items inside subfolders of a matched folder. Choose Only include items that match search query or All items in folder (even if they don't match search query).
    • Select items in lists and attachments (list expansion): Export files attached to SharePoint lists and their child items. Choose All items in SharePoint list if any item matches search query. If applicable, select Include list attachments.
  10. In the Messages and related items from mailboxes and Exchange Online section, select one or more of the following options:

    • Organize conversation into HTML transcript: Contextual chat messages are threaded into HTML transcripts for ease of review and handling.

    • Include Teams and Viva Engage conversations: Include messages posted within a 12-hour window before and after each responsive item.

    • Access links (cloud attachments) in messages: Collect items from links to SharePoint or OneDrive

      Important

      Including cloud attachments increases the size and quantity of your exported results.

    • Select a version for access links. Values are Latest version only, Recent 10 versions, Recent 100 versions, All versions.

      Important

      If you have versions as shared feature enabled, this retrieves the version of the document when it was shared.

  11. In the Export type section, choose one of the following options:

    • Export items report only: Only the summary and item report are created. The various options for organizing data, folder and path structure, condensing paths, and other structures are hidden.
    • Export items with items report: Items are exported with the item report. Other export format options are available with this option in the Export format section.
  12. In the Export format section, choose one of the following options:

    • Create PSTs for messages: This option creates .pst files for messages.
    • Create .msg files for messages: This option creates .msg files for messages
  13. Select one or more of the following output package options. For details for each option, see Export package options.

  • Organize data from different locations into separate folders or PSTs: This option organizes data into separate folders for each data location.
    • Include folder and path of the source: This option includes the original folder and folder path structure for items.
    • Condense paths to fit within 256 characters: This option condenses the folder path for each item to 259 characters or less.
    • Give each item a friendly name: This option creates a friendly name for each item.
  1. Select Export.
  2. When your export process is started, a confirmation dialog is displayed. Select OK to continue.

For more information about export files types, file sizes and counts, and Item report fields, see Export reference for eDiscovery.

Export package options

The export package options control how content are packaged in downloadable export packages. Depending on your needs and the post-export process an eDiscovery user needs to perform, you can adjust these options as needed.

Organize data from different locations into separate folders or PSTs

This setting controls whether exported content is grouped by its original source. This includes grouping specific mailboxes or specific OneDrive or SharePoint sites, or combined these items into a single container.

For Exchange Mailbox items

  • Selected: Each mailbox’s content is exported into a separate PST file named after the mailbox (for example, john.doe@contoso.com.pst).
  • Not selected: All mailbox content across the selected data sources is merged into a single PST file (for example, exchange.pst), subject to the maximum PST size limit. If the combined data exceeds this limit, additional PSTs are created.

For OneDrive and SharePoint items

  • Selected: Content is exported into separate folders per site. Each folder is named after the site and all files from that site are placed in each folder to preserve site-level organization.
  • Not selected: All content is exported into a single folder regardless of the originating site. Use the items.csv to understand the original source location and other relevant metadata for the item.

Include folder and path of the source

This setting determines whether the original folder structure from the source is preserved in the exported data. This source is the folder where items reside in its Exchange mailbox or OneDrive and SharePoint site.

For Exchange Mailbox items

  • Selected: The exported PST retains the full folder hierarchy from the mailbox. For example, if a message was located in Inbox > Legal > Q2, this exact path is preserved inside the PST. This helps reviewers understand the original context and organization of the content.
  • Not selected: All messages are flattened into the root of the PST file, with no folder structure retained. While the messages are still exported, the original location within the mailbox is lost in the content itself. To find the original path of the item, review the items.csv in process report.

In both cases, the export process creates one PST file per mailbox if the Organize data from different locations into separate folders or PSTs option is selected. The Include folder and path of the source option only affects the internal folder structure within each PST.

For OneDrive and SharePoint items

  • Selected: Files are exported with the full folder path preserved. For example, if a file was stored in Department > Legal > Contracts > Proposal.docx, the entire path is recreated in the export package for this file. This structure mirrors the original site structure in which the file resides.
  • Not selected: All files from a site are placed directly into a single folder for that site, without any subfolders. For example, if a file was stored in Department > Legal > Contracts > Proposal.docx,, the path is For example, if a file was stored in SharePoint > Items > Proposal.docx. This flattens the structure and might mix files from different folders. To find the original folder structure of the item, review the items.csv in process report.

Condense paths to fit within 259 characters limit

This setting helps prevent unzipping errors caused by long file paths during export, especially when exporting content from OneDrive and SharePoint sites where items are deeply nested inside many layers of folders.

OneDrive and SharePoint sites might have deeply nested folder structures and long file names. When exporting content with the option to preserve folder and path structure selected, the resulting file paths can exceed the Windows file system limit of 259 characters. This can lead to the following error message when unzipping the export package:

The file name(s) would be too long for the destination folder. You can shorten the file name and try again.

To help avoid this this issue, use this option as needed:

  • Selected: The export process automatically truncates folder paths - by shortening folder names or collapsing intermediate folders - so that the total path length for each file stays within the 259-character limit. This helps ensure that the export package can be unzipped and accessed without errors.
  • Not selected: The full original folder path is preserved. While this maintains the most accurate representation of the source structure, it increases the risk of hitting the path length limit—especially for deeply nested OneDrive and SharePoint items.

Note

Different unzip utilities handle long file names and folder paths differently. The built-in extraction tool in Windows File Explorer might fail if the file name or path exceeds its character limit. Other non-Microsoft tools support longer paths and can extract these files successfully.

Give each item a friendly name

This setting controls if the export items uses its original friendly name or unique GUID generated by eDiscovery.

For Exchange Mailbox items

Note

This setting doesn't apply when exporting exchange items to PST format. Regardless of whether this option is selected, email messages in PST exports always retain the original subject lines for the message title within the PST file.

When exporting as a .msg file:

  • Selected: Exported .msg file uses the subject of the email.
  • Not selected: Exported .msg file uses a system generated GUID.

For OneDrive and SharePoint items

  • Selected: Files are exported using the original file names. For example, a file named Q2_Budget_Plan.docx in SharePoint is exported with the exact same name in the export package.

    • If multiple files have the same name and the folder structure is not preserved (the Include folder and path of the source option isn't selected), this might lead to file name collisions in the export folder. If this happens, the suffix is appended to the collided file names to differentiate the files.

    • When exporting versions, friendly names include version suffixes to distinguish between versions of the file. For example, Project Plan.docx, Project Plan_v1.docx and Project Plan_v2.docx

  • Not selected: Files are exported using system-generated identifiers. This ensures uniqueness and avoids naming conflicts. For example, Project Plan.docx might be named b7f3a9c2-4e1e-4c9a-9f3e-2a1d8e7f9c1a.docx in the export package. Use the items.csv in process report to correlate the original title and other relevant metadata for the file.

View the export process status

To view the progress of the export in the Process manager, select Process manager and the Export process to track the process status and to download export packages.

The Overview tab shows a progress bar that displays the current status, number of locations, and number of items for the export. An estimated completion and current elapsed time are displayed in hours, minutes, and seconds. The Overview tab also contains the following export information:

  • Name: The name of the export.
  • Completed: The UTC date and time the export process was completed.
  • Duration: The duration of the export process.
  • Status: The current status of the export process.
  • Process type: The Export process type value is displayed.
  • Created: The UTC date and time the export was created.
  • Created by: The user that created the export.

The Settings tab displays a summary of the export options you selected for the export process.

Export packages

Important

The export package links generated during the eDiscovery export process are intended for individual use only and shouldn't be shared. The behavior of these links is subject to change and they might become invalid or inaccessible if used by others or accessed outside of the context of current user. If data sharing from the portal is need, use guest accounts.

After the export process is complete, export packages are available to download. The export packages are listed in the Export packages section on the Overview tab and include the package name and size. To download a package, select the package and select Download packages.

Best practices for downloading export packages

To ensure a smooth download experience, consider the following best practices:

  • Allow pop-ups from Microsoft Purview: The download process triggers a pop-up window. Make sure your browser is configured to allow pop-ups from the Microsoft Purview site. For example, see instructions on how to configure pop-ups on Microsoft Edge.

  • Set your preferred download location: By default, export packages might be saved to your browser’s default download folder. If you prefer to choose where files are saved, update your browser settings to prompt for a download location each time. See instruction for changing the downloads folder location in Microsoft Edge.

  • Check your organization's network configuration: Ensure that your organization allows downloads from Microsoft Purview by verifying that all required endpoints and IP addresses are allowlisted. This includes enabling access to the Microsoft Purview export service and associated Azure storage endpoints. If your organization uses network security tools such as Zscaler, Microsoft Defender for Endpoint (MDE), or other proxy/firewall solutions, make sure these tools are configured to allow traffic to the export endpoints. For optimal performance and to avoid download interruptions, consider using a local drive (not a network share), and test your connection throughput to Azure endpoints. For detailed allowlist guidance, see Microsoft 365 URLs and IP address ranges.

  • Enable parallel downloading in your browser settings: Use parallel downloading to improve download speeds for large eDiscovery export packages. For example, edge://flags in Microsoft Edge. This can significantly reduce wait times by allowing simultaneous file chunk downloads. This setting is also available for other chromium-based browser.

  • Use a download manager: Using a download manager can improve the reliability and speed of large file downloads. A download manage allows you to resume interrupted downloads and manage network fluctuations, which is especially helpful when downloading large export packages.